tkt-ino / io-uring-uaf

Use-After-Free vulnerability in Linux's io_uring
0 stars 0 forks source link

Machine Crashes #3

Open tkt-ino opened 8 months ago

tkt-ino commented 8 months ago

Machine crashes after program execution

tkt-ino commented 8 months ago

logs

[ 1813.040487] BUG: Bad page state in process wpa_supplicant  pfn:1c7c41
[ 1813.040506] page:00000000cdb68f05 refcount:0 mapcount:-1 mapping:0000000000000000 index:0x1 pfn:0x1c7c41
[ 1813.040518] flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff)
[ 1813.040525] page_type: 0xfffffffe()
[ 1813.040533] raw: 0017ffffc0000000 dead000000000100 dead000000000122 0000000000000000
[ 1813.040539] raw: 0000000000000001 0000000000000000 00000000fffffffe 0000000000000000
[ 1813.040543] page dumped because: nonzero mapcount
[ 1813.040546] Modules linked in: ccm binfmt_misc snd_hda_codec_realtek snd_hda_codec_generic snd_hda_codec_hdmi ledtrig_audio intel_rapl_msr nls_iso8859_1 intel_rapl_common snd_hda_intel snd_intel_dspcfg x86_pkg_temp_thermal intel_powerclamp snd_intel_sdw_acpi coretemp snd_hda_codec crct10dif_pclmul polyval_clmulni snd_hda_core polyval_generic snd_hwdep ghash_clmulni_intel pn544_mei mei_phy aesni_intel snd_pcm pn544 crypto_simd ath9k_htc cryptd hci ath9k_common rapl nfc mei_hdcp mei_pxp ath9k_hw intel_cstate ath snd_seq_midi snd_seq_midi_event hp_wmi i915 input_leds snd_rawmidi drm_buddy mac80211 joydev sparse_keymap snd_seq ttm snd_seq_device wmi_bmof platform_profile serio_raw at24 snd_timer cfg80211 spi_nor drm_display_helper cec libarc4 mtd rc_core snd drm_kms_helper mei_me i2c_algo_bit mei soundcore tpm_infineon mac_hid sch_fq_codel msr parport_pc ppdev lp drm parport efi_pstore ip_tables x_tables autofs4 hid_generic usbhid hid spi_intel_platform crc32_pclmul spi_intel i2c_i801 psmouse ahci i2c_smbus libahci e1000e
[ 1813.040745]  lpc_ich xhci_pci xhci_pci_renesas video wmi
[ 1813.040761] CPU: 0 PID: 5662 Comm: wpa_supplicant Not tainted 6.5.0-18-generic #18~22.04.1-Ubuntu
[ 1813.040769] Hardware name: Hewlett-Packard HP ProDesk 600 G1 SFF/18E7, BIOS L01 v02.75 05/04/2018
[ 1813.040774] Call Trace:
[ 1813.040779]  <TASK>
[ 1813.040786]  dump_stack_lvl+0x48/0x70
[ 1813.040799]  dump_stack+0x10/0x20
[ 1813.040806]  bad_page+0x76/0x120
[ 1813.040817]  free_page_is_bad_report+0x66/0x80
[ 1813.040826]  free_unref_page_prepare+0x265/0x410
[ 1813.040838]  free_unref_page+0x34/0x180
[ 1813.040848]  ? __mod_lruvec_page_state+0x12f/0x160
[ 1813.040858]  __folio_put+0x3f/0x90
[ 1813.040866]  folio_put+0x16/0x20
[ 1813.040875]  wp_page_copy+0x2f3/0x630
[ 1813.040886]  do_wp_page+0x22f/0x340
[ 1813.040898]  handle_pte_fault+0x164/0x170
[ 1813.040909]  __handle_mm_fault+0x65c/0x720
[ 1813.040919]  handle_mm_fault+0x164/0x360
[ 1813.040927]  do_user_addr_fault+0x160/0x6b0
[ 1813.040936]  exc_page_fault+0x83/0x1b0
[ 1813.040947]  asm_exc_page_fault+0x27/0x30
[ 1813.040959] RIP: 0033:0x562ebbc8bbb6
[ 1813.040996] Code: 25 28 00 00 00 0f 85 8a 00 00 00 48 83 c4 20 5b 5d 41 5c c3 48 83 bb a0 00 00 00 00 75 cf 48 8b bb a8 00 00 00 e8 4a ca ea ff <48> c7 83 a8 00 00 00 00 00 00 00 eb c0 0f 1f 44 00 00 4c 8b a3 90
[ 1813.041002] RSP: 002b:00007ffef9aa1b20 EFLAGS: 00010246
[ 1813.041009] RAX: 0000000000000000 RBX: 0000562ebc052190 RCX: 0000000000000002
[ 1813.041014] RDX: 0000562ebc052190 RSI: 0000562ebc052190 RDI: 0000000000000000
[ 1813.041018] RBP: 00007ffef9aa1b20 R08: 0000562ebc13ac10 R09: 00007ffef9aa1940
[ 1813.041022] R10: 0000000000000000 R11: 7a1558b228ee92c6 R12: 0000562ebc052750
[ 1813.041026] R13: 0000562ebc132120 R14: 0000000000000000 R15: 00007ffef9aa1be0
[ 1813.041035]  </TASK>
[ 1813.041038] Disabling lock debugging due to kernel taint
tkt-ino commented 8 months ago
[ 2103.325869] BUG: Bad rss-counter state mm:00000000dccbfe7c type:MM_FILEPAGES val:-1
[ 2103.325877] BUG: Bad rss-counter state mm:00000000dccbfe7c type:MM_ANONPAGES val:1